Skip to content

Security boundaries

The public site is a presentation and read-only evidence surface. It is not a private tenancy boundary.

Documentation safety

Public docs must not contain:

  • passwords or SSH credentials;
  • API keys or bearer tokens;
  • private hostnames and internal service credentials;
  • DataHub secrets;
  • raw provider requests;
  • private dataset rows;
  • Apollo configuration or catalog names.

Use placeholders such as <DATAHUB_GMS_URL> and <TOKEN> in examples.

Runtime safety

  • Keep DataHub GMS, MCP, OpenTelemetry, and Jaeger ports on loopback or a private Docker network.
  • Keep the Evidence MCP service on the private Docker networks. Give it a separate read-only receipt token and exact release allowlist; never reuse the operator token that can run releases or repairs.
  • Keep the OpenRouter key in a private environment file or secret manager.
  • Mount the public Analytics Agent snapshot read-only.
  • Expose only themis_nyc_taxi through the public agent route.
  • Reject settings, connector, OAuth, release, and history administration on the public route.
  • Do not use a browser bundle as a secret store.
  • Do not trust a client-supplied engine name.

Nginx safety

The Nginx server block uses security headers and returns 404 for sensitive project paths. The docs alias must be narrower than the site root. It must not turn on directory listing.

After a change, inspect headers and routes:

curl -fsSI https://azharizz.blog/themis/docs/
curl -fsS -o /dev/null -w "%{http_code}\n" https://azharizz.blog/themis/
curl -fsS -o /dev/null -w "%{http_code}\n" https://azharizz.blog/apollo/

What a public visitor can learn

The docs explain the Themis design and the public demo behavior. They do not expose private runtime state. Current release receipts remain the authority for a specific run. The Analytics Agent must say when a value is not in its available evidence sources.